# Filebeat ERROR x509: certificate signed by unknown authority **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [January 11, 2023, 12:12am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861 "2023-01-11T00:12:52Z")\ **Posts on this page:** 6\ **Page:** 2
**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Post date:** [January 11, 2023, 1:13am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/21 "2023-01-11T01:13:58Z")
thank you for your help ---
**Author:** ![litronics](https://avatars.discourse-cdn.com/v4/letter/l/8491ac/32.png) [@litronics](https://discuss.elastic.co/u/litronics)\ **Post date:** [January 11, 2023, 7:02am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/22 "2023-01-11T07:02:16Z")
Personally I install the CA certificate as trusted root authority on the OS itself. That solved all the CA certificate issues and makes the configuration of the stack much easier as I don't need to provide the certificate to each service separately. Another hint: If you run the Elastic-Agent within a docker container, it is totally irrelevant what environment variable you use to configure the trusted CA certificate. Initially I provided all of them and the agent still complain about the untrusted certificate. That went away as I built my own image with the CA certificate added to the OS's trust store. ---
**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Post date:** [January 11, 2023, 8:45pm UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/23 "2023-01-11T20:45:12Z")
Thank you litronics The problem is it is not my server and I can't do what ever I want on Customer host It is production server and I don't want to make smth bad on it. Thank you for your answer though ---
**Author:** ![litronics](https://avatars.discourse-cdn.com/v4/letter/l/8491ac/32.png) [@litronics](https://discuss.elastic.co/u/litronics)\ **Post date:** [January 12, 2023, 7:58am UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/24 "2023-01-12T07:58:25Z")
I don't know your infrastructure and how this integrates into your Customer netowrk hosts. However providing SSL/TLS certificates or distributing a additional root CA certificate shouldn't be rocketsience nowadays. Problably you can ask your customer to distribute den certificate to his servers? Or if he is running his own PKI, ask him to sign the required certificates with his CA and import his root certificate into the ELK stack services? ---
**Author:** ![vassiliy.vins](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/vassiliy.vins/32/113615_2.png) [@vassiliy.vins](https://discuss.elastic.co/u/vassiliy.vins)\ **Post date:** [January 12, 2023, 4:38pm UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/25 "2023-01-12T16:38:15Z")
Hi! For the moment I'm working on testing environment and will play with certificates It will be important if client will decide to use ELK ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [February 9, 2023, 6:38pm UTC](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861/26 "2023-02-09T18:38:26Z")
Closed on February 9, 2023, 6:38pm UTC This topic was automatically closed 28 days after the last reply. New replies are no longer allowed. [Previous page](https://discuss.elastic.co/t/filebeat-error-x509-certificate-signed-by-unknown-authority/322861.md?page=1)